The best way to avoid this as a company is to not use SMS to implement 2FA!
At worst it's no worse than SMS, but at best it's at least secure in transport and effectively free.
The downside to email is primarily that data is not a roaming perk for many. But if it's too access an app then a reasonable assumption of internet access even if not on the mobile is valid.
Also, email delivery sometimes takes a very long time, it can be minutes, if you rely on email forwarding to protect your main email address.
Auth apps are better for 2FA, at least for me.
Separate from that, it is not productive for you to tell me to think about it more -- for all you know I've implemented two factor authentication in various forms for decades (from OPIE when I worked at NRL to Smartcards within DOD to Passkeys currently). What would be more productive is to get more insight into what you're thinking
Does that happen with SMS? Hmm...
To answer your question on whether or not people access other people's SMS accounts -- yes! That's one reason it's not recommended any longer. Additionally, there's often less security possible for ones SMS account versus ones email account.
You would have to get access to their email and SMS to perform a password reset and get past 2FA. If you are saying you could do a SIM swap attack simply by having access to their email I think that is not that practical at all.
> To answer your question on whether or not people access other people's SMS accounts -- yes!
What? I never asked that? What are you even talking about?
Are you imagining that email is used in some other additional way in the authentication process, such as account recovery ?
I don't know about Android but Apple users can literally start adopting TOTP without changing a single thing.
Providers should simply add instructions telling people that if they have an Apple device they can just go to the keychain and add the code displayed on the screen or use the QR with the camera
So which one is the nice phone vendor shipping one on device?
Porting some app into another OS would be probably a showstopper due to budgets/deadlines, even though even my old Nokia in 2006 could easily run java apps like these (but ended up mostly running Snake et al).
For literally years Google Authenticator had no means to move between phones. Of course people who were told to use it decided never to use OTP apps again after getting screwed.
Yubikeys (and google's keys) have had issues where the keys were extractable and needed to be replaced.
and so on.
SMS has just worked. Yes, it has reliability issues, but it's almost like people can't model even the most basic ways that the non-SMS tech is basically terrible. Even Apple doesn't work well because of the broadcast behavior of the confirmations.
With 2FA, you at least have to log into successfully without the cell phone first, it’s harder to exploit. You can pretty easily rate limit 2FA prompts per account, auto-ban malicious accounts, etc. While SMS OTP flows are extremely easy to exploit - the text is sent before any sort of association with and account occurs, making rate limiting, banning, etc. much more difficult.
You need to cover your ass, but you don't want to actively push back and risk losing the sale.
So you either need to support SMS or several of the major 2FA app providers including the crappier implementations like Microsoft authenticator.